Re: IPsec !?, was: Re: CGA Use with HBA in Shim6 IETF Meeting July 10, 2006

[Francis Dupont <Francis.Dupont@point6.net>]

 In your previous mail you wrote:

   >    there is no general any-to-any mechanism to prove address ownership
   >    using IPsec which is what is provided by CGA/HBA,
   >
   > => I strongly disagree: we don't need such a mechanism because IPsec
   > is based on mutual authentication which is a stronger property than
   > what is provided by CGA/HBA.
   
   but in order to do that you need or a shared secret or an PKI right?
   
=> yes but this is not the subject of my answer: you argued IPsec
doesn't provide the right service, I argued it provides it and
perhaps (surely in fact) a lot of other services. The way IPsec can
(cannot in fact) be used is another topics.

Regards
   
Francis.Dupont@point6.net